Skip to content

Commit 8ef18a6

Browse files
waldekmastykarzwaldekmastykarz
committed
WIP: Adds code signing
1 parent 83f8406 commit 8ef18a6

1 file changed

Lines changed: 131 additions & 75 deletions

File tree

‎.github/workflows/create-release.yml‎

Lines changed: 131 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,30 @@ jobs:
6161
Get-ChildItem -Filter *.deps.json -Recurse | Remove-Item
6262
Get-ChildItem -Filter *.runtimeconfig.json -Recurse | Remove-Item
6363
popd
64+
- name: Install Sign CLI tool
65+
working-directory: ./${{ env.release }}
66+
run: dotnet tool install --tool-path . sign --version 0.9.1-beta.25181.2
67+
- name: Azure CLI Login
68+
uses: azure/login@v2
69+
with:
70+
client-id: ${{ secrets.DOTNET_APPLICATION_ID }}
71+
tenant-id: ${{ secrets.DOTNET_TENANT_ID }}
72+
subscription-id: ${{ secrets.DOTNET_SUBSCRIPTION_ID }}
73+
- name: Sign binaries
74+
working-directory: ./${{ env.release }}
75+
shell: pwsh
76+
run: >
77+
./sign code azure-key-vault
78+
**/devproxy*
79+
--publisher-name "Dev Proxy"
80+
--description "Simulate API failures, throttling, and chaos - all from your command line."
81+
--description-url "https://aka.ms/devproxy"
82+
--azure-key-vault-tenant-id "${{ secrets.DOTNET_TENANT_ID }}"
83+
--azure-key-vault-client-id "${{ secrets.DOTNET_APPLICATION_ID }}"
84+
--azure-key-vault-certificate "${{ secrets.DOTNET_CERTIFICATE_NAME }}"
85+
--azure-key-vault-url "${{ secrets.DOTNET_VAULT_URL }}"
86+
--timestamp-url http://timestamp.digicert.com
87+
--verbosity Debug
6488
- name: Archive release ${{ env.release }}
6589
uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # master
6690
with:
@@ -74,6 +98,22 @@ jobs:
7498
with:
7599
name: binaries-${{ env.release }}
76100
path: ./${{ env.release }}.zip
101+
- name: Sign abstractions
102+
if: matrix.architecture == 'win-x64'
103+
working-directory: ./${{ env.release }}
104+
shell: pwsh
105+
run: >
106+
./sign code azure-key-vault
107+
./dev-proxy-abstractions/bin/Release/net9.0/devproxy*.dll
108+
--publisher-name "Dev Proxy"
109+
--description "Simulate API failures, throttling, and chaos - all from your command line."
110+
--description-url "https://aka.ms/devproxy"
111+
--azure-key-vault-tenant-id "${{ secrets.DOTNET_TENANT_ID }}"
112+
--azure-key-vault-client-id "${{ secrets.DOTNET_APPLICATION_ID }}"
113+
--azure-key-vault-certificate "${{ secrets.DOTNET_CERTIFICATE_NAME }}"
114+
--azure-key-vault-url "${{ secrets.DOTNET_VAULT_URL }}"
115+
--timestamp-url http://timestamp.digicert.com
116+
--verbosity Debug
77117
- name: Archive abstractions
78118
if: matrix.architecture == 'win-x64'
79119
uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # master
@@ -114,8 +154,24 @@ jobs:
114154
run: cp ./${{ steps.installer.outputs.filename }} ./${{ env.release }}
115155
- name: Build Installer
116156
if: contains(matrix.architecture, 'win-')
117-
run: ISCC.exe ${{ steps.installer.outputs.filename }} /F"dev-proxy-installer-${{ matrix.architecture }}-${{ github.ref_name }}"
157+
run: ISCC.exe ${{ steps.installer.outputs.filename }} /F"dev-proxy-installer-${{ matrix.architecture }}-${{ github.ref_name }}"
158+
working-directory: ./${{ env.release }}
159+
- name: Sign installer
160+
if: contains(matrix.architecture, 'win-')
118161
working-directory: ./${{ env.release }}
162+
shell: pwsh
163+
run: >
164+
./sign code azure-key-vault
165+
./dev-proxy-installer-*.exe
166+
--publisher-name "Dev Proxy"
167+
--description "Simulate API failures, throttling, and chaos - all from your command line."
168+
--description-url "https://aka.ms/devproxy"
169+
--azure-key-vault-tenant-id "${{ secrets.DOTNET_TENANT_ID }}"
170+
--azure-key-vault-client-id "${{ secrets.DOTNET_APPLICATION_ID }}"
171+
--azure-key-vault-certificate "${{ secrets.DOTNET_CERTIFICATE_NAME }}"
172+
--azure-key-vault-url "${{ secrets.DOTNET_VAULT_URL }}"
173+
--timestamp-url http://timestamp.digicert.com
174+
--verbosity Debug
119175
- name: Upload Installer
120176
if: contains(matrix.architecture, 'win-')
121177
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
@@ -151,77 +207,77 @@ jobs:
151207
args: |
152208
output/binaries-*/*.zip
153209
output/installer-*/*.exe
154-
deploy_docker:
155-
name: Publish Docker image
156-
runs-on: ubuntu-latest
157-
needs: [create_release]
158-
permissions:
159-
contents: read
160-
packages: write
161-
attestations: write
162-
id-token: write
163-
steps:
164-
- name: Checkout repository
165-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
166-
# Required for multi-platform images
167-
- name: Set up QEMU
168-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
169-
# Required for multi-platform images
170-
- name: Set up Docker Buildx
171-
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
172-
with:
173-
driver-opts: image=moby/buildkit:latest
174-
- name: Log in to the Container registry
175-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
176-
with:
177-
registry: ${{ env.REGISTRY }}
178-
username: ${{ github.actor }}
179-
password: ${{ secrets.GITHUB_TOKEN }}
180-
- name: Extract metadata (tags, labels) for Docker
181-
id: meta
182-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
183-
with:
184-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
185-
flavor: |
186-
latest=false
187-
tags: |
188-
type=semver,pattern={{version}}
189-
type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') }}
190-
type=raw,value=beta,enable=${{ contains(github.ref_name, '-beta') }}
191-
labels: |
192-
org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
193-
annotations: |
194-
org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
195-
- name: Build and push Docker image
196-
if: "!contains(github.ref_name, '-beta')"
197-
id: push
198-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
199-
with:
200-
context: .
201-
push: true
202-
tags: ${{ steps.meta.outputs.tags }}
203-
labels: ${{ steps.meta.outputs.labels }}
204-
annotations: ${{ steps.meta.outputs.annotations }}
205-
platforms: linux/amd64,linux/arm64
206-
build-args: |
207-
DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
208-
- name: Build and push beta Docker image
209-
if: contains(github.ref_name, '-beta')
210-
id: push_beta
211-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
212-
with:
213-
context: .
214-
file: ./Dockerfile_beta
215-
push: true
216-
tags: ${{ steps.meta.outputs.tags }}
217-
labels: ${{ steps.meta.outputs.labels }}
218-
annotations: ${{ steps.meta.outputs.annotations }}
219-
platforms: linux/amd64,linux/arm64
220-
build-args: |
221-
DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
222-
- name: Generate artifact attestation
223-
uses: actions/attest-build-provenance@v2
224-
with:
225-
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
226-
subject-digest: ${{ steps.push.outputs.digest || steps.push_beta.outputs.digest }}
227-
push-to-registry: true
210+
# deploy_docker:
211+
# name: Publish Docker image
212+
# runs-on: ubuntu-latest
213+
# needs: [create_release]
214+
# permissions:
215+
# contents: read
216+
# packages: write
217+
# attestations: write
218+
# id-token: write
219+
# steps:
220+
# - name: Checkout repository
221+
# uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
222+
# # Required for multi-platform images
223+
# - name: Set up QEMU
224+
# uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
225+
# # Required for multi-platform images
226+
# - name: Set up Docker Buildx
227+
# uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
228+
# with:
229+
# driver-opts: image=moby/buildkit:latest
230+
# - name: Log in to the Container registry
231+
# uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
232+
# with:
233+
# registry: ${{ env.REGISTRY }}
234+
# username: ${{ github.actor }}
235+
# password: ${{ secrets.GITHUB_TOKEN }}
236+
# - name: Extract metadata (tags, labels) for Docker
237+
# id: meta
238+
# uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
239+
# with:
240+
# images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
241+
# flavor: |
242+
# latest=false
243+
# tags: |
244+
# type=semver,pattern={{version}}
245+
# type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') }}
246+
# type=raw,value=beta,enable=${{ contains(github.ref_name, '-beta') }}
247+
# labels: |
248+
# org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
249+
# annotations: |
250+
# org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
251+
# - name: Build and push Docker image
252+
# if: "!contains(github.ref_name, '-beta')"
253+
# id: push
254+
# uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
255+
# with:
256+
# context: .
257+
# push: true
258+
# tags: ${{ steps.meta.outputs.tags }}
259+
# labels: ${{ steps.meta.outputs.labels }}
260+
# annotations: ${{ steps.meta.outputs.annotations }}
261+
# platforms: linux/amd64,linux/arm64
262+
# build-args: |
263+
# DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
264+
# - name: Build and push beta Docker image
265+
# if: contains(github.ref_name, '-beta')
266+
# id: push_beta
267+
# uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
268+
# with:
269+
# context: .
270+
# file: ./Dockerfile_beta
271+
# push: true
272+
# tags: ${{ steps.meta.outputs.tags }}
273+
# labels: ${{ steps.meta.outputs.labels }}
274+
# annotations: ${{ steps.meta.outputs.annotations }}
275+
# platforms: linux/amd64,linux/arm64
276+
# build-args: |
277+
# DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
278+
# - name: Generate artifact attestation
279+
# uses: actions/attest-build-provenance@v2
280+
# with:
281+
# subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
282+
# subject-digest: ${{ steps.push.outputs.digest || steps.push_beta.outputs.digest }}
283+
# push-to-registry: true

0 commit comments

Comments
 (0)